Methods for detecting and mitigating malicious network behavior and devices thereof

ABSTRACT

Methods, non-transitory computer readable media, anomaly detection apparatuses, and network traffic management systems that generate, based on the application of one or more models and for a first flow associated with a received first set of network traffic, one or more likelihood scores and at least one flow score based on the likelihood scores. One or more of the one or more models are associated with one or more browsing patterns for a web application to which the first set of network traffic is directed. A determination is made when the flow score exceeds a threshold. A mitigation action is initiated, based on a stored policy, with respect to the first set of network traffic, when the determining indicates that the flow score exceeds the established threshold.

This application is a continuation of U.S. patent application Ser. No.15/710,552, filed on Sep. 20, 2017, which claims the benefit of U.S.Provisional Patent Application Ser. No. 62/397,003, filed on Sep. 20,2016, each of which is hereby incorporated by reference in its entirety.

FIELD

This technology generally relates to network security and, moreparticularly, to methods and devices for detecting and mitigatingmalicious network behavior.

BACKGROUND

Storage networks generally include servers that store data, such as webapplications, web pages, or other content. Often, the servers areprotected from malicious attacks by traffic management devices, whichcan perform other functions including load balancing and applicationacceleration, for example. One such set of attacks are denial of service(DOS) attacks and another type of attack is referred to as web scraping,although many other types of malicious attacks exist.

Malicious attacks can be identified based on anomalous network trafficreceived by the traffic management devices. Often the originator of suchanomalous network traffic is a robot (also referred to as a “bot”)capable of automatically generating requests for web resources.

Unfortunately, current traffic management devices are ineffective atdetecting malicious network behavior and distinguishing network attacksfrom benign behavior, resulting in false positives. In particular,current methods of identifying bots and malicious network attacks arenot robust, and false positives often occur resulting in theimplementation of mitigation techniques on benign traffic.

SUMMARY

A method for detecting and mitigating malicious network behaviorimplemented by a network traffic management system comprising one ormore anomaly detection apparatuses, client devices, or server devices,the method including generating, based on the application of one or moremodels and for a first flow associated with a received first set ofnetwork traffic, one or more likelihood scores and at least one flowscore based on the likelihood scores. One or more of the one or moremodels are associated with one or more browsing patterns for a webapplication to which the first set of network traffic is directed. Adetermination is made when the flow score exceeds a threshold. Amitigation action is initiated, based on a stored policy, with respectto the first set of network traffic, when the determination indicatesthat the flow score exceeds the established threshold.

An anomaly detection apparatus, comprising one or more comprising memorycomprising programmed instructions stored thereon and one or moreprocessors configured to be capable of executing the stored programmedinstructions to generate, based on the application of one or more modelsand for a first flow associated with a received first set of networktraffic, one or more likelihood scores and at least one flow score basedon the likelihood scores. One or more of the one or more models areassociated with one or more browsing patterns for a web application towhich the first set of network traffic is directed. A determination ismade when the flow score exceeds a threshold. A mitigation action isinitiated, based on a stored policy, with respect to the first set ofnetwork traffic, when the determination indicates that the flow scoreexceeds the established threshold.

A non-transitory computer readable medium having stored thereoninstructions for detecting and mitigating malicious network behaviorcomprising executable code which when executed by one or moreprocessors, causes the processors to generate, based on the applicationof one or more models and for a first flow associated with a receivedfirst set of network traffic, one or more likelihood scores and at leastone flow score based on the likelihood scores. One or more of the one ormore models are associated with one or more browsing patterns for a webapplication to which the first set of network traffic is directed. Adetermination is made when the flow score exceeds a threshold. Amitigation action is initiated, based on a stored policy, with respectto the first set of network traffic, when the determination indicatesthat the flow score exceeds the established threshold.

A network traffic management system, comprising one or more anomalydetection apparatuses, client devices, or server devices, the networktraffic management system comprising memory comprising programmedinstructions stored thereon and one or more processors configured to becapable of executing the stored programmed instructions to generate,based on the application of one or more models and for a first flowassociated with a received first set of network traffic, one or morelikelihood scores and at least one flow score based on the likelihoodscores. One or more of the one or more models are associated with one ormore browsing patterns for a web application to which the first set ofnetwork traffic is directed. A determination is made when the flow scoreexceeds a threshold. A mitigation action is initiated, based on a storedpolicy, with respect to the first set of network traffic, when thedetermination indicates that the flow score exceeds the establishedthreshold.

This technology has a number of associated advantages includingproviding methods, non-transitory computer readable media, anomalydetection apparatuses, and network traffic management systems that moreeffectively identify anomalous or malicious network traffic therebysignificantly improving security for web applications. With thistechnology, sub-models associated with historical browsing patterns forweb applications are used to determine whether observed behavior for aparticular flow is anomalous. Accordingly, this technologyadvantageously improves network security and reduces false positives.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of an exemplary network traffic managementsystem with an anomaly detection apparatus;

FIG. 2 is a block diagram of an exemplary traffic management device ofthe anomaly detection apparatus shown in FIG. 1;

FIG. 3 is a block diagram of an exemplary analytic server device of theanomaly detection apparatus shown in FIG. 1;

FIG. 4 is a flowchart of an exemplary method for facilitating detectionof malicious network traffic with the analytic server device shown inFIGS. 1 and 3;

FIG. 5 is a flow diagram of exemplary offline and online processingrelating to anomaly detection;

FIG. 6 is a flowchart of an exemplary method for detecting maliciousnetwork traffic with the traffic management device shown in FIGS. 1 and2;

FIG. 7 is a flow diagram of a method for detecting malicious networktraffic with the traffic management device shown in FIGS. 1 and 2; and

FIG. 8 is a timing diagram of network traffic capture, model generation,and model consumption.

DETAILED DESCRIPTION

Referring to FIG. 1, an exemplary network traffic management system,which incorporates an exemplary anomaly detection apparatus 12 with atraffic management device 14 and an analytic server device 16 isillustrated. In this example, the traffic management device 14 iscoupled to client devices 18(1)-18(n) through communication network(s)20, server devices 22(1)-22(n) through a local area network (LAN) 24,and the analytic server device 16 through a direct connection, althoughthe traffic management device 14, client devices 18(1)-18(n), serverdevices 22(1)-2(n), and analytic server device 16 may be coupledtogether via other topologies. Additionally, the network trafficmanagement system 10 may include other network devices such as one ormore routers and/or switches, for example, which are well known in theart and thus will not be described herein. This technology provides anumber of advantages including methods, non-transitory computer readablemedia, anomaly detection apparatuses, and network traffic managementsystems that more effectively detect and mitigate malicious networkbehavior, including anomalous web application usage.

Referring to FIGS. 1-2, the traffic management device 14 of the networktraffic management system 10 may perform any number of functions inaddition to detecting anomalous malicious network traffic includingaccelerating and optimizing network traffic communicated between theserver devices 22(1)-22(n) and client devices 18(1)-18(n) in order toimprove the user experience. The traffic management device 14 also canperform other functions on the network traffic, such as trafficmanagement, load balancing the network traffic to the server devices22(1)-22(n) and/or implementing firewalls or other security measures onbehalf of web applications executing on the server devices 22(1)-22(n),by way of example only. The traffic management device 14 includesprocessor(s) 26, a memory 28, and a communication interface 30, whichare coupled together by a bus 32 or other communication link, althoughthe traffic management device 14 may include other types and/or numbersof elements in other configurations.

The processor(s) 26 of the traffic management device 14 may executeprogrammed instructions for any number of the functions identified aboveand/or described herein for detecting malicious network traffic and,optionally, managing network traffic and/or optimizing service ofcontent requests, by way of example only. The processor(s) 26 of thetraffic management device 14 may include one or more central processingunits and/or general purpose processors with one or more processingcores, by way of example only, although other types of processor(s) alsocan be used.

The memory 28 of the traffic management device 14 stores theseprogrammed instructions for one or more aspects of the presenttechnology as described and illustrated herein, although some or all ofthe programmed instructions could be stored and executed elsewhere. Avariety of different types of memory storage devices, such as randomaccess memory (RAM), read only memory (ROM), hard disk, solid statedrives, flash memory, or other computer readable medium which is readfrom and written to by a magnetic, optical, or other reading and writingsystem that is coupled to the processor(s) 26, can be used for thememory 28.

Accordingly, the memory 28 of the traffic management device 14 can storeone or more applications that can include computer executableinstructions that, when executed by the traffic management device 14,cause the traffic management device 14 to perform actions, such as totransmit, receive, or otherwise process messages, by way of exampleonly, and to perform other actions described and illustrated below withreference to FIGS. 4-8. The application(s) can be implemented as modulesor components of other applications. Further, the application(s) can beimplemented as operating system extensions, module, plugins, or thelike.

Even further, the application(s) may be operative in a cloud-basedcomputing environment. The application(s) can be executed within or asvirtual machine(s) or virtual server(s) that may be managed in acloud-based computing environment. Also, the application(s), and eventhe traffic management device 14 itself, may be located in virtualserver(s) running in a cloud-based computing environment rather thanbeing tied to one or more specific physical network computing devices.Also, the application(s) may be running in one or more virtual machines(VMs) executing on the traffic management device 14. Additionally, inone or more embodiments of this technology, virtual machine(s) runningon the traffic management device 14 may be managed or supervised by ahypervisor.

In this particular example, the memory 28 further includes at least oneweb application model 34, at least one anomaly detection model 36, andan attack mitigation module 38. The traffic management device 14 obtainsdata regarding observed client-side network traffic directed to a webapplication and associated with a flow and applies the web applicationmodel 34 and anomaly detection model 36 to raw features associated withthe network traffic to determine whether one of the client devices 18(1)-18(n) associated with the flow is engaging in anomalous behaviorwith respect to the web application. A flow as used herein is acollection or requests and responses received from a same one of theclient devices 18(1)-18(n) or user of one or more of the client devices18(1)-18(n). In some examples, the web application model 34 and anomalydetection model 36 stored in the memory 28 of the traffic managementdevice 14 are periodically received from and generated by the analyticserver device 16, as described and illustrated in more detail later.

The web application model 34 in this example includes a plurality ofsub-models associated with browsing patterns for the web application, asdescribed and illustrated in more detail later. The traffic managementdevice 14 can apply the web application model 34 to the flow associatedwith the network traffic to generate likelihood scores for each of thesub-models. The likelihood scores are indicative of whether the activityassociated with one of the sub-models is likely anomalous or benign.

By way of example only, the network traffic may be a first request for aweb page associated with the web application. Since the request is afirst request, the web page is a start page for the flow associated withthe network traffic. One of the sub-models may be a start node modelthat, when applied to the network traffic, can generate a likelihoodscore indicating how likely the web page is to be a start page for aflow (e.g., based on historical observations or other factors, asdescribed and illustrated in more detail later). Many other examples ofsub-models are described and illustrated in more detail later.

The traffic management device 14 in this example can apply the anomalydetection model 36 to each of the likelihood scores generated based onthe application of the web application model 34 to the flow in order togenerate a flow score indicative of whether the one of the clientdevices 18(1)-18(n) associated with the flow is engaging in anomalousnetwork behavior, in which case a mitigation action may need to beinitiated for the network traffic. Accordingly, the anomaly detectionmodel 36 can include a plurality of weights for the various likelihoodscores as well as other factors and other parameters that facilitate thegeneration of the flow score for a flow, as described and illustrated inmore detail later.

The attack mitigation module 38 in this example executes a mitigationpolicy to initiate mitigation actions when the traffic management device12 determines that the flow score for a flow, as generated based on theapplication of the anomaly detection model 36, by way of example only,exceeds a threshold indicating that the one of the client devices18(1)-18(n) associated with the flow is likely engaging in anomalous ormalicious network behavior. The mitigation policy can apply any numberof factors, such as the amount that the flow score has exceeded thethreshold or attributes of the one of the client devices 18(1)-18(n), byway of example only, in order to determine the mitigation action, asdescribed and illustrated in more detail later.

The communication interface 30 of the traffic management device 14operatively couples and communicates between the traffic managementdevice 14, client devices 18(1)-18(n), server devices 22(1)-22(n), andanalytic server device 16, which are all coupled together by the LAN 24,communication network(s) 20 and direct connection(s), although othertypes and/or numbers of communication networks or systems with othertypes and/or numbers of connections and configurations to other devicesand elements. By way of example only, the LAN 24 and/or communicationnetwork(s) 20 can use TCP/IP over Ethernet and industry-standardprotocols, including NFS, CIFS, SOAP, XML, LDAP, and SNMP, althoughother types and/or numbers of communication networks, can be used.

The communication network(s) 20 and/or LAN 24 in this example can employany suitable interface mechanisms and network communication technologiesincluding, for example, teletraffic in any suitable form (e.g., voice,modem, and the like), Public Switched Telephone Network (PSTNs),Ethernet-based Packet Data Networks (PDNs), combinations thereof, andthe like. The communication network(s) 20 and/or LAN 24 can also includedirect connection(s) (e.g., for when a device illustrated in FIG. 1,such as the traffic management device 14, analytic server device 16,and/or server devices 22(1)-22(n) operate as virtual instances on thesame physical machine).

Referring to FIGS. 1-3, the analytic server device 16 is configured tomonitor network traffic, sanitize network traffic (e.g., to ensure onlynon-bot traffic is used to generate and update web application andanomaly detection models), associate network traffic with flows, andprocess the network traffic to generate web application and anomalydetection models. While the analytic server device 16 is illustrated inthis particular example as a separate device that allows significantprocessing related to model generation and machine learning to beperformed separate from the traffic management device 14, in otherexamples, the functionality provided by the analytic server device 16can be performed by analytic modules included in the memory 28 of thetraffic management device 14.

In yet other examples, the analytic server device 16 can be located in alocal network or outside of a local network and accessible via a cloudarchitecture, by way of example only. Other configurations of thetraffic management device 14 and analytic server device 16, includingmodel generators thereof, also can be used. In this particular example,the analytic server device 16 includes processor(s) 40, a memory 42, anda communication interface 44, which are coupled together by a bus 46 orother communication link, although the analytic server device 16 mayinclude other types and/or numbers of elements in other configurations.

The processor(s) 40 of the analytic server device 16 may executeprogrammed instructions for any number of the functions identified aboveand/or described herein for generating web application and anomalydetection models that facilitate the identification of anomalous ormalicious network behavior by the traffic management device 14. Theprocessor(s) 40 of the analytic server device 16 may include one or morecentral processing units and/or general purpose processors with one ormore processing cores, by way of example only.

The memory 42 of the analytic server device 16 stores these programmedinstructions for one or more aspects of the present technology asdescribed and illustrated herein, although some or all of the programmedinstructions could be stored and executed elsewhere. A variety ofdifferent types of memory storage devices, such as random access memory(RAM), read only memory (ROM), hard disk, solid state drives, flashmemory, or other computer readable medium which is read from and writtento by a magnetic, optical, or other reading and writing system that iscoupled to the processor(s) 40, can be used for the memory 42.

Accordingly, the memory 42 of the analytic server device 16 can storeone or more applications that can include computer executableinstructions that, when executed by the analytic server device 16, causethe analytic server device 16 to perform actions, such as to transmit,receive, or otherwise process messages, by way of example only, and toperform other actions described and illustrated below with reference toFIGS. 4-8. The application(s) can be implemented as modules orcomponents of other applications. Further, the application(s) can beimplemented as operating system extensions, module, plugins, or thelike.

Even further, the application(s) may be operative in a cloud-basedcomputing environment. The application(s) can be executed within or asvirtual machine(s) or virtual server(s) that may be managed in acloud-based computing environment. Also, the application(s), and eventhe analytic server device 16 itself, may be located in virtualserver(s) running in a cloud-based computing environment rather thanbeing tied to one or more specific physical network computing devices.Also, the application(s) may be running in one or more virtual machines(VMs) executing on the analytic server device 16. Additionally, in oneor more embodiments of this technology, virtual machine(s) running onthe analytic server device 16 may be managed or supervised by ahypervisor.

In this particular example, the memory 42 of the analytic server device16 further includes a web application model generator 48 and an anomalydetection model generator 50. The web application model generator 48 isconfigured to generate the web application model 34, includingsub-models, for a particular web application. The web application model34 for a web application may be based on time of day, day of the month,or client device platform (e.g., mobile or desktop), by way of exampleonly. As briefly explained earlier, and described and illustrated inmore detail herein, the web application model 34 encapsulates obtainedknowledge regarding browsing patterns and activities associated with aweb application. According, the web application model 34 includessub-models associated with specific types of activities that areconfigured to, when applied to a flow, generate a likelihood scoreindicative of whether the activities are likely anomalous.

The anomaly detection model generator 50 in this example is configuredto generate the anomaly detection model 36 that, when applied, isconfigured to analyze the likelihood scores, output based on anapplication of a web application model 34, to generate a flow score fora flow indicative of whether the flow is likely malicious. The flowscore can then be used to determine whether a mitigation action shouldbe initiated for the flow in order to protect the web application andassociated one or more of the server device(s) 22(1)-22(n) hosting theweb application, as described and illustrated in more detail earlier.Accordingly, in this example, the analytic server device 16 constantlymonitors network traffic and periodically refines and updates the webapplication model 34 and anomaly detection model 36 that are sent to thetraffic management device 14 to be applied to received network traffic.

The communication interface 44 of the analytic server device 16operatively couples and communicates with the traffic management device14, which is coupled to the analytic server devices 16 by a directconnection or LAN (not shown), although other types and/or numbers ofcommunication networks or systems with other types and/or numbers ofconnections and configurations to other devices and elements also can beused.

Each of the server devices 22(1)-22(n) of the network traffic managementsystem 10 in this example includes one or more processors, a memory, anda communication interface, which are coupled together by a bus or othercommunication link, although other numbers and types of network devicescould be used. The server devices 22(1)-22(n) in this example processrequests received from the client devices 18(1)-18(n) via thecommunication network(s) 20 according to the HTTP-based application RFCprotocol, by way of example only. Various applications may be operatingon the server devices 22(1)-22(n) and transmitting data (e.g., files orWeb pages) to the client devices 18(1)-18(n) via the traffic managementdevice 14 in response to requests from the client devices 18(1)-18(n).The server devices 22(1)-22(n) may be hardware or software or mayrepresent a system with multiple servers in a pool, which may includeinternal or external networks.

Although the server devices 22(1)-22(n) are illustrated as singledevices, one or more actions of each of the server devices 22(1)-22(n)may be distributed across one or more distinct network computing devicesthat together comprise one or more of the server devices 22(1)-22(n).Moreover, the server devices 22(1)-22(n) are not limited to a particularconfiguration. Thus, the server devices 22(1)-22(n) may contain aplurality of network computing devices that operate using a master/slaveapproach, whereby one of the network computing devices of the serverdevices 22(1)-22(n) operate to manage and/or otherwise coordinateoperations of the other network computing devices. The server devices22(1)-22(n) may operate as a plurality of network computing deviceswithin a cluster architecture, a peer-to peer architecture, virtualmachines, or within a cloud architecture, by way of example only.

Thus, the technology disclosed herein is not to be construed as beinglimited to a single environment and other configurations andarchitectures are also envisaged. By way of example only, one or more ofthe server devices 22(1)-22(n) can operate within the traffic managementdevice 14 itself, rather than as a standalone device. In this example,the one or more of the server devices 22(1)-22(n) operate within thememory 28 of the traffic management device 14.

The client devices 18(1)-18(n) of the network traffic management system10 in this example include any type of computing device that cangenerate, receive, and process network traffic, such as mobile computingdevices, desktop computing devices, laptop computing devices, tabletcomputing devices, virtual machines (including cloud-based computers),or the like. Each of the client devices 18(1)-18(n) in this exampleincludes a processor, a memory, and a communication interface, which arecoupled together by a bus or other communication link, although othernumbers and types of network devices could be used.

The client devices 18(1)-18(n) may run interface applications, such asstandard web browsers or standalone client applications, which mayprovide an interface to make requests for, and receive content storedon, one or more of the server devices 22(1)-22(n) via the communicationnetwork(s) 20. Such applications can include emulated or headlessbrowsers (e.g., PhantomJS) that automatically generate malicious networktraffic. The client devices 18(1)-18(n) may further include a displaydevice, such as a display screen or touchscreen, and/or an input device,such as a keyboard by way of example only.

Although the exemplary network traffic management system 10 with thetraffic management device 14, client devices 18(1)-18(n), server devices22(1)-22(n), analytic server device 16, LAN 24, and communicationnetwork(s) 20 are described and illustrated herein, other types and/ornumbers of systems, devices, components, and elements in othertopologies can be used. It is to be understood that the systems of theexamples described herein are for exemplary purposes, as many variationsof the specific hardware and software used to implement the examples arepossible, as will be appreciated by those skilled in the relevantart(s).

One or more of the components depicted in the network traffic managementsystem 10, such as the traffic management device 14, client devices18(1)-18(n), server devices 22(1)-22(n), or analytic server device 16,by way of example only, may be configured to operate as virtualinstances on the same physical machine. In other words, one or more ofthe traffic management device 12, client devices 18(1)-18(n), serverdevices 22(1)-22(n), or analytic server device 16 may operate on thesame physical device rather than as separate devices communicatingthrough communication network(s). Additionally, there may be more orfewer traffic management device, client devices, server devices, oranalytic server devices than illustrated in FIG. 1.

In addition, two or more computing systems or devices can be substitutedfor any one of the systems or devices in any example. Accordingly,principles and advantages of distributed processing, such as redundancyand replication also can be implemented, as desired, to increase therobustness and performance of the devices and systems of the examples.The examples may also be implemented on computer system(s) that extendacross any suitable network using any suitable interface mechanisms andtraffic technologies, including by way of example only teletraffic inany suitable form (e.g., voice and modem), wireless traffic media,wireless traffic networks, cellular traffic networks, G3 trafficnetworks, Public Switched Telephone Network (PSTNs), Packet DataNetworks (PDNs), the Internet, intranets, and combinations thereof.

The examples may also be embodied as one or more non-transitory computerreadable media having instructions stored thereon for one or moreaspects of the present technology as described and illustrated by way ofthe examples herein. The instructions in some examples includeexecutable code that, when executed by one or more processors, cause theprocessors to carry out steps necessary to implement the methods of theexamples of this technology that are described and illustrated herein.

Exemplary methods for detecting anomalous network traffic will now bedescribed with reference to FIGS. 1-8. Referring more specifically toFIG. 4, a method for facilitating detection of malicious network trafficwith the analytic server device 16 is illustrated. In step 400 in thisexample, the analytic server device 16 of the anomaly detectionapparatus 12 receives network traffic and associates the network trafficwith a flow. The network traffic is received from one of the clientdevices 18(1)-18(n) and is directed to a web application hosted by oneof the server devices 22(1)-22(n) in this example. The analytic serverdevice 16 can capture all network traffic received by the anomalydetection apparatus 12 or only a portion of the traffic, with or withoutcapture continuity (e.g., capturing a request in a session withoutcapturing the next or previous request in the session).

In this example, the analytic server device 16 optionally sanitizes thenetwork traffic prior to associating the network traffic with a flow.Accordingly, the analytic server device 16 can filter non-regulartraffic, such as traffic likely to have originated from a bot, as wellas traffic originating from a relatively unreliable source, by way ofexample only. By way of example only, reliability of a source can bedetermined based on availability of a session cookie, fingerprinting, anon-bot user agent in a header of one or more packets of the networktraffic, or any other parameters or characteristics. The sanitization ofthe network traffic can improve the accuracy and effectiveness of theweb application model 34 and anomaly detection model 36 that aregenerated by the analytic server device 16, as described and illustratedin more detail later.

Subsequent to the optional sanitization, the analytic server device 16associates the network traffic with a flow and performs a flowconstruction. In one example, the analytic server device 16 generatesand inserts cookies into network traffic associated with a flow.Accordingly, the cookies in this example include flow identifiers thatare maintained throughout a session, included with associated networktraffic, and used to associate network traffic with a particular flow.In another example, the HTTP referrer header can be used to perform theflow construction and to order the network traffic within a flow. Othertypes and/or numbers of attributes and/or other methods of flowconstruction and associating received network traffic with a flow alsocan be used.

In step 402, the analytic server device 16 extracts one or more rawfeatures associated with the network traffic. Depending on the type ofnetwork traffic, the one or more raw features can include a URI of a webresource, a timestamp, a type of a web resource, or an indication ofwhether the web page is a first or last page for a flow, by way ofexample only, although any other features associated with the networktraffic also can be extracted or determined from one or more attributesof the network traffic.

In another example, the analytic server device 16 can return client-sideexecutable JavaScript code, for example, in response to receiving thenetwork traffic from the one of the client devices 18(1)-18(n). TheJavaScript code, when executed by the one of the client devices18(1)-18(n), can obtain, and send to the analytic server device 16, rawfeatures such as browsing history and behavior patterns. In particular,the JavaScript code can be configured to send URLs navigated from/to,time of navigating to a web page, time spent in a web page, performanceof a web page (e.g., loading time), mouse/keyboard activity level, thenumber of web page revisits, the history length, or the number ofsessions.

In this example, one or more portions of the obtained raw features canbe persisted client-side by using HTML5 storage or other browser levelstorage (e.g., LocalStorage, IndexedDB, WebSQL, or FileAPI). In oneexample, the JavaScript code can be configured to initiate a periodictransmission of the raw features (e.g., using an AJAX call) to theanalytic server device 16. Other raw features can also be obtained usingclient-side executable JavaScript and other methods for obtaining rawfeatures can also be used in other examples.

In step 404, the analytic server device 16 of the anomaly detectionapparatus 12 generates, for a new web application, or updates, for anexisting web application, one or more sub-model(s) of the webapplication model 34 based on the raw features. Optionally, a number ofweb application models can be generated or updated for a webapplication. By way of example only, the web application model 34 can bemaintained for a web application for a particular user platform (e.g.,desktop or mobile) or for a particular time of day or day of the week,although other types and/or numbers of web application models also canbe maintained for a web application.

The web application model 34 in this example is a collection ofstandalone sub-models that collectively encapsulate knowledge regardingbrowsing patterns for the web application, although the web applicationmodel 34 can be organized in other ways. Each of the sub-modelsencapsulates knowledge regarding a particular aspect of browsingpatterns for the application and is configured to generate one or morelikelihood scores that reflect whether the behavior and correspondingflow is anomalous and potentially malicious.

By way of example only, the web application model 34 can include startor end node sub-models that encapsulate knowledge regarding start andend pages, respectively, that are relatively popular for the webapplication, and is configured to determine the probability of enteringor exiting, respectively, the application in any of the applicationpages. Accordingly, given information regarding a flow, including thestart or end page for the flow, the start and end node sub-models areconfigured to generate one or more likelihood scores that reflect thelikelihood that the start or end page, respectively, for a particularflow is unreasonable and associated with malicious behavior with respectto the web application.

In another example, the web application model 34 can include a page hitsub-model that is configured to determine the popularity distribution ofone or more of the web pages associated with the web application.Accordingly, the page hit sub-model models the popularity distributionof the pages in a browsing flow and generates likelihood scores for eachaccessed page in a flow based on the popularity of the page. Optionally,the likelihood scores for each accessed page can be aggregated into anaverage or median, by way of example only, for the flow, which is outputby the page hit sub-model.

The web application model 34 also can include a web resource hitsub-model that is configured to determine the popularity distribution ofweb resources associated with the web application, which can be web pageand non-web page resources (e.g., images or scripts). Accordingly, theweb resource hit sub-model models the popularity distribution of the webresources in a browsing flow and generates likelihood scores foraccessed resource in a flow based on the popularity of the resource.Optionally, the likelihood scores for each accessed resource also can beaggregated into an average or median, by way of example only, for theflow, which is output by the web resource hit sub-model.

In yet another example, the web application model 34 can include forwardor backward transition sub-models that are configured to determine thedistribution of forward and backward transitions in a browsing flow,respectively, in the web application. More specifically, the forwardtransition sub-model is configured to determine a likelihood score basedon a likelihood that a current request would be for a particular webpage based on another web page that was the subject of a prior request.Additionally, the backward transition sub-model is configured todetermine a likelihood score based on a likelihood that a prior requestwould be for a particular web page based on another web page that is thesubject of a current request. Accordingly, the likelihood scores for oneor more web pages associated with a current flow can optionally beaggregated and output by the forward or backward transition sub-models.

The web application model 34 also can include a visit period sub-modelthat is configured to model the time a user remains in a web page forthe web application. Accordingly, the visit period sub-model can collectpage transition times based on timestamps and determine the timedifference between the next page request and the original page requestto determine the visit period. Accordingly, each web page for a webapplication may have an associated distribution, which is used togenerate a likelihood score for a current visit time for one or more ofthe web pages. The likelihood scores for any number of web pages in acurrent flow can be aggregated to generate a likelihood score for theflow that is output by the visit period sub-model.

In another example, the web application model 34 can include a resourceor Asynchronous JavaScript and eXtensible Markup Language (XML) (AJAX)inclusion sub-models. The resource and AJAX inclusion sub-models areconfigured to model the distribution of resource or AJAX inclusionsubsets for each page in a browsing flow for the web application.Accordingly, for each web page associated with the web application, theresource or AJAX inclusion sub-model can determine the likelihood that aset of resources or AJAX scripts associated with the web page would berequested subsequent to the web page. The likelihood scores for anynumber of web pages in a current flow are optionally aggregated togenerate a likelihood score for the flow that is output by the resourceor AJAX inclusion sub-models.

In yet another example, the web application model 34 can include asections sub-model that is configured to model sequences of web pages(e.g., three to five web pages) that are the most popular in the webapplication. Accordingly, the sections sub-model can analyze sets ofrequests and associated web pages in a flow for a web application todetermine and output a likelihood scores reflecting the likelihood thatthe set of web pages would be requested. Other numbers and types ofsub-models associated with browsing patterns for the web applicationalso can be used in other examples.

In step 406, the analytic server device 16 generates, for a new webapplication, or updates, for an existing web application, an anomalydetection model 36 for the web application. The anomaly detection model36 is configured to aggregate the likelihood scores generated by anapplication of one or more sub-models of the web application model 34 toa current flow in order to generate a flow score. The flow scorereflects the likelihood of a flow in the web application, which isindicative of whether the flow may be malicious.

Accordingly, the anomaly detection model 36 obtains likelihood scoresgenerated by sub-models of the web application model 34 for a flow anddetermines a flow score for the flow that can be compared to athreshold, as described and illustrated in more detail later.Optionally, the likelihood scores are aggregated by the anomalydetection model 36 using weights, which can be dynamic across webapplications and different times for particular web applications, andcan depend on flow length.

Optionally, the analytic server device 16 can maintain a database,organized based on flow identifiers, that includes information,including extracted raw features, for each of a plurality of priorand/or current flows. The database can be used by the web applicationmodel generated 48 or anomaly detection model generator 50 to determineprobability distributions and generate or update the web applicationmodel 34 or anomaly detection model 36.

In step 408, the analytic server device 16 in this particular examplesends the web application model 34 and anomaly detection model 36, orone or more updates thereto, to the traffic management device 14.Optionally, the analytic server device 16 utilizes a training set ofnetwork traffic to generate and update the web application model 34 oranomaly detection model 36 in steps 404 and 406 prior to sending the webapplication model 34 or anomaly detection model 36 to the trafficmanagement device 14. Accordingly, steps 400-406 can be repeated until asufficient training period has elapsed such that the web applicationmodel 34 or anomaly detection model 36 can be applied with sufficientconfidence and accuracy.

In response to receiving the web application model 34 and anomalydetection model 36, the traffic management device 14 applies the webapplication model 34 or anomaly detection model 36 to current networktraffic in order to determine whether the network traffic is malicious,in which case a mitigation action should be initiated, as described andillustrated in more detail later. The current network traffic also canbe the same network traffic concurrently analyzed by the analytic serverdevice 16 to update one or more of the web application model 34 oranomaly detection model 36 subsequent to the training period, by way ofexample only.

Referring more specifically to FIG. 5, a flow diagram of offline andonline processing relating to anomaly detection in one exemplaryimplementation of this technology is illustrated. In this particularexample, the offline processing or model generation flow is performed bythe analytic server device 16 in a cloud architecture. Accordingly, theanalytic server device 16 buffers captured network traffic, sanitizesthe network traffic, associates the network traffic with a particularflow and performs a flow construction or ordering, generates the webapplication model 34 or anomaly detection model 36, and sends the webapplication model 34 or anomaly detection model 36 to the trafficmanagement device 14 to be applied to current network traffic.

Referring more specifically to FIG. 6, a method for detecting maliciousnetwork traffic with the traffic management device 14 is illustrated. Instep 600 in this example, the traffic management device 14 of theanomaly detection apparatus 12 obtains the web application model 34 andanomaly detection model 36 from the analytic server device 16. The webapplication model 34 and anomaly detection model 36 can relate to a webapplication hosted by one of the server devices 22(1)-22(n) andprotected by the traffic management device 14, by way of example only.

The web application model 34 and anomaly detection model 36 can be sentto the traffic management device 14 by the analytic server device 16 asdescribed and illustrated earlier with reference to step 408 of FIG. 4.Additionally more than one web application or anomaly detection modelcan be obtained in step 600. By way of example only, web applicationmodel 34 and anomaly detection model 36 can be specific to particularplatforms or time period, although other types and/or numbers of modelsalso can be obtained and used as described and illustrated in moredetail later.

In step 602, the traffic management device 14 receives network trafficdirected to the web application and associates the network traffic witha flow. The network traffic can be received from one of the clientdevices 18(1)-18(n) and can be associated with a flow as described andillustrated earlier with reference to step 400 of FIG. 4. In oneexample, the traffic management device 14 can use a session cookie toassociate the network traffic with a flow, although other attributes ofthe network traffic also can be used. Additionally, the trafficmanagement device 14 constructs or orders the network traffic within theflow, such as based on a referrer header in packets corresponding to thenetwork traffic, by way of example only, although the flow also can beconstructed in other ways.

In step 604, the traffic management device 14 extracts raw featuresassociated with the network traffic, such as described and illustratedearlier with reference to step 402 of FIG. 4, by way of example only.Optionally, the traffic management device 14 can maintain a databaseorganized by flow identifiers (e.g., maintained in session cookies) thatincludes raw features extracted from network traffic associated with theflow. By way of example only, a URI of a start web page can be stored inan entry of the database as associated with the flow to be used when theweb application model 34 is applied, as described and illustrated inmore detail later. Other types and/or numbers of information also can bemaintained in the database for one or more of the observed flows.

In step 606, the traffic management device 14 selects the webapplication model 34 and the anomaly detection model 36. In examples inwhich multiple web application model or anomaly detection models areobtained in step 600, the traffic management device 14 can select one ofeach type of the models based on one or more characteristics of theflow. By way of example only, if a user agent header in network trafficassociated with the flow indicates a mobile web browser, then a webapplication model for mobile platforms may be selected in step 606. Inanother example, a web application or anomaly detection model may beselected based on a current time of day or day of the week, by way ofexample only, and other types of models can be maintained and selectedin step 606.

In step 608, the traffic management device 14 of the anomaly detectionapparatus applies one or more sub-models of the selected web applicationmodel 34 to the flow based on the extracted or stored raw features togenerate one or more likelihood scores. Generally, a plurality ofsub-models will be applied, although not all sub-models of webapplication model 34 may be applicable at a particular point in time(e.g., an end node sub-model may not be applicable if the flow did notexit the web application) or due to a lack of sufficient raw featuresfor the sub-model to generate sufficiently accurate likelihood score(s).

In step 610, the traffic management device 14 applies the selectedanomaly detection model 36 to the likelihood scores generated in step608 in order to generate a flow score for the flow. Accordingly, thetraffic management device 14 can aggregate the likelihood scores basedon specified weights according to the anomaly detection model 36 inorder to generate a flow score. Optionally, one or more likelihoodscores can be stored and used in the application of the anomalydetection model 36. By way of example only, the likelihood scoregenerated by a start node sub-model will not change over time since astart page for the web application is only accessed once during a flow.Accordingly, the likelihood score generated by the start node sub-modeldoes not need to be recalculated for multiple applications of theanomaly detection model 36 throughout the lifetime of a flow.

Referring more specifically to FIG. 7, a flow diagram of a method fordetecting malicious network traffic with the traffic management device14 is illustrated. In this particular example, the traffic managementdevice 14 extracts raw features for a flow based on observed networktraffic directed to a web application and applies the web applicationmodel 34 with a plurality of sub-models 700-716 associated with browsingpatterns for the web application. Next, the traffic management device 14aggregates (e.g., averages), with an aggregator 718, likelihood scoresoutput by a subset of the sub-models in order to generate one likelihoodscore for each of the subset of the sub-models, although other types ofaggregations could be used.

The traffic management device 14 then applies the anomaly detectionmodel 36 to the likelihood scores generated by each of the sub-models,as output by the aggregator 718 for the subset of the sub-models togenerate a flow score for the flow. The application of the anomalydetection model 36 can include applying weights to one or more of thelikelihood scores, by way of example only.

Referring back to FIG. 6, in step 612, the traffic management device 14determines whether the flow score generated in step 610 exceeds anestablished threshold. The threshold flow score can be dynamic, learnedover time, and representative of whether the flow, associated networktraffic, and corresponding web application behavior is likely malicious.If the traffic management device 14 determines that the flow scoreexceeds the threshold, then the Yes branch is taken to step 614.

In step 614, the traffic management device 14 enforces a mitigationpolicy on the network traffic using the attack mitigation module 38 byway of example only. The type of mitigation initiated with respect tothe network traffic for the flow can be based on the flow score, one ormore characteristics of the flow, or any number of other attributes.Accordingly, mitigation actions can include dropping the network trafficand blocking subsequent network traffic associated with the flow ororiginating from the one of the client devices 18(1)-18(n), slowing theprocessing or deprioritizing the network traffic, or flagging the flowas potentially malicious resulting in heightened analysis of subsequentnetwork traffic associated with the flow. Other types of mitigationactions also can be initiated in other examples.

Referring back to FIG. 5, the online processing or anomaly detectionflow is performed by the traffic management device 14 in one example ofthis technology. In this particular example, the traffic managementdevice 14 captures traffic, constructs flow(s), and performs a scoringbased on a web application model 34 received from the analytic serverdevice 16 to generate a plurality of likelihood scores for varioussub-models associated with browsing patterns for the web application.

The traffic management device 14 then applies an anomaly detection model36 to the likelihood scores to generate a flow score. The webapplication model 34 and anomaly detection model 36 are generated by theanalytic server device 16 in an offline processing or model generationflow, as described and illustrated in more detail earlier. With the flowscore, the traffic management device 14 performs policy enforcement andapplies a mitigation policy to selectively initiate a mitigation actionbased on a comparison of the generated flow score to a threshold flowscore.

Referring back to FIG. 6, subsequent to enforcing the mitigation policyon the network traffic, or if the traffic management device 14determines in step 612 that the flow score does not exceed the thresholdand the No branch is taken, then the traffic management device 14proceeds to step 616. In step 616, the traffic management device 14determines whether any updated web application model 34 or anomalydetection model 36 has been generated by the analytic server device 16.

Referring more specifically to FIG. 8, a timing diagram of networktraffic capture, model generation, and model consumption is illustrated.In this particular example, network traffic to be associated with ModelA is captured (e.g., observed and raw features extracted) for a periodof time until capture of network traffic to be associated with Model Bis initiated. While network traffic to be associated with Model B isbeing captured, Model A is being generated. Subsequently, Model A isconsumed or sent to the traffic management device 14 and applied toreceived network traffic directed to the web application.

Accordingly, while Model A is being consumed, network traffic to beassociated with Model C is being captured and Model B is beinggenerated. In this example, each of the Models A, B, and C can be a webapplication model and the Models B and C can be updated versions ofpreviously generated web application models (e.g., Model A and B,respectively). Therefore, the web application models in this example anbe continuously updated so as to improve effectiveness based on machinelearning and other techniques applied to an increased volume of observednetwork traffic. One or more of the Models A, B, or C could also beanomaly detection models and other types of models could also be used inother examples.

Referring back to FIG. 6, if the traffic management device 14 determinesthat no updated web application model 34 or anomaly detection model 36have been generated by the analytic server device 16, then the No branchis taken back to step 602 and the traffic management device 14 continuesreceiving network traffic directed to the web application.Alternatively, if the traffic management device 14 determines in step616 that one or more updated ones of the web application model 34 oranomaly detection model 36 have been generated by the analytic serverdevice 16, then the Yes branch is taken back to step 600 and the trafficmanagement device 14 obtains the updated web application model 34 oranomaly detection model 36 from the analytic server device 16.

Accordingly, with this technology, anomalous or malicious networktraffic can more effectively be identified and security for webapplications can be significantly improved. In particular, thistechnology uses a plurality of sub-models associated with historicalbrowsing patterns for web applications to determine whether observedbehavior for a particular flow is anomalous. Additionally, thistechnology provides an optimized and relatively comprehensive analysisof web application behavior and advantageously reduces false positiveswith respect to the identification of malicious network traffic.

Having thus described the basic concept of the disclosed technology, itwill be rather apparent to those skilled in the art that the foregoingdetailed disclosure is intended to be presented by way of example only,and is not limiting. Various alterations, improvements, andmodifications will occur and are intended to those skilled in the art,though not expressly stated herein. These alterations, improvements, andmodifications are intended to be suggested hereby, and are within thespirit and scope of the disclosed technology. Additionally, the recitedorder of processing elements or sequences, or the use of numbers,letters, or other designations therefore, is not intended to limit theclaimed processes to any order except as may be specified in the claims.Accordingly, the disclosed technology is limited only by the followingclaims and equivalents thereto.

What is claimed is:
 1. A method for network security implemented by anetwork traffic management system comprising one or more anomalydetection apparatuses, server devices, or client devices, the methodcomprising: applying a model to received network traffic to generate alikelihood score and a flow score based on the likelihood score, whereinof the model is associated with a browsing pattern for a web applicationto which the network traffic is directed; and initiating a mitigationaction against the network traffic, when the flow score exceeds athreshold.
 2. The method of claim 1, further comprising: updating asub-model of the model based on an obtained raw feature associated withother received network traffic; and sending a client-side script to aclient that originated the other network traffic, the client-side scriptconfigured to, when executed, return the raw feature associated with theother network traffic.
 3. The method of claim 2, wherein the sub-modelcomprises a start node model, an end node model, a page hit model, a webresource hit model, a forward transition model, a backward transitionmodel, a visit period model, a resource inclusion model, or anAsynchronous JavaScript and eXtensible Markup Language (XML) (AJAX)inclusion model.
 4. The method of claim 1, wherein the model comprises aweb application model and an anomaly detection model and the methodfurther comprises applying the web application model to the networktraffic to generate the likelihood score and the anomaly detection modelto the likelihood score to generate the flow score.
 5. The method ofclaim 1, further comprising selecting the model from a plurality ofstored models based on a current time or a platform corresponding to aflow associated with the network traffic.
 6. A non-transitory computerreadable medium having stored thereon instructions for network securitycomprising executable code which when executed by one or moreprocessors, causes the processors to: apply a model to received networktraffic to generate a likelihood score and a flow score based on thelikelihood score, wherein of the model is associated with a browsingpattern for a web application to which the network traffic is directed;and initiating a mitigation action against the network traffic, when theflow score exceeds a threshold.
 7. The non-transitory computer readablemedium of claim 6, wherein the executable code when executed by theprocessors further causes the processors to: update a sub-model of themodel based on an obtained raw feature associated with other receivednetwork traffic; and send a client-side script to a client thatoriginated the other network traffic, the client-side script configuredto, when executed, return the raw feature associated with the othernetwork traffic.
 8. The non-transitory computer readable medium of claim7, wherein the sub-model comprises of a start node model, an end nodemodel, a page hit model, a web resource hit model, a forward transitionmodel, a backward transition model, a visit period model, a resourceinclusion model, or an Asynchronous JavaScript and eXtensible MarkupLanguage (XML) (AJAX) inclusion model.
 9. The non-transitory computerreadable medium of claim 6, wherein the model comprise a web applicationmodel and an anomaly detection model and the executable code whenexecuted by the processors further causes the processors to apply theweb application model to the network traffic to generate the likelihoodscore and the anomaly detection model to the likelihood score togenerate the flow score.
 10. The non-transitory computer readable mediumof claim 6, wherein the executable code when executed by the processorsfurther causes the processors to select the model from a plurality ofstored models based on a current time or a platform corresponding to aflow associated with the network traffic.
 11. An anomaly detectionapparatus comprising: a memory comprising programmed instructions storedthereon and one or more processors configured to execute the storedprogrammed instructions to: apply a model to received network traffic togenerate a likelihood score and a flow score based on the likelihoodscore, wherein the model is associated with a browsing pattern for a webapplication to which the network traffic is directed; and initiating amitigation action against the network traffic, when the flow scoreexceeds a threshold.
 12. The anomaly detection apparatus of claim 11,wherein the processors are further configured to execute the storedprogrammed instructions to: update a sub-model of the model based on anobtained raw feature associated with other received network traffic; andsend a client-side script to a client that originated the other networktraffic, the client-side script configured to, when executed, return ofthe raw feature associated with the other network traffic.
 13. Theanomaly detection apparatus of claim 12, wherein the sub-model comprisesa start node model, an end node model, a page hit model, a web resourcehit model, a forward transition model, a backward transition model, avisit period model, a resource inclusion model, or an AsynchronousJavaScript and eXtensible Markup Language (XML) (AJAX) inclusion model.14. The anomaly detection apparatus of claim 11, wherein the modelcomprises a web application model and an anomaly detection model and theprocessors are further configured to execute the stored programmedinstructions to apply the web application model to the network trafficto generate the likelihood score and the anomaly detection model to thelikelihood score to generate the flow score.
 15. The anomaly detectionapparatus of claim 11, wherein the processors are further configured toexecute the stored programmed instructions to select the model from aplurality of stored models based on a current time or a platformcorresponding to a flow associated with the network traffic.
 16. Anetwork traffic management system comprising: one or more anomalydetection apparatuses, server devices, or client devices with memorycomprising programmed instructions stored thereon and one or moreprocessors configured to execute the stored programmed instructions to:apply a model to received network traffic to generate a likelihood scoreand a flow score based on the likelihood score, wherein the model isassociated with a browsing pattern for a web application to which thenetwork traffic is directed; and initiating a mitigation action againstthe network traffic, when the flow score exceeds a threshold.
 17. Thenetwork traffic management system of claim 16, wherein the processorsare further configured to execute the stored programmed instructions to:update a sub-model of the model based on an obtained raw featureassociated with other received network traffic; and send a client-sidescript to a client that originated the other network traffic, theclient-side script configured to, when executed, return of the rawfeature associated with the other network traffic.
 18. The networktraffic management system of claim 17, wherein the sub-model comprises astart node model, an end node model, a page hit model, a web resourcehit model, a forward transition model, a backward transition model, avisit period model, a resource inclusion model, or an AsynchronousJavaScript and eXtensible Markup Language (XML) (AJAX) inclusion model.19. The network traffic management system of claim 16, wherein the modelcomprises a web application model and an anomaly detection model and theprocessors are further configured to execute the stored programmedinstructions to apply the web application model to the network trafficto generate the likelihood score and the anomaly detection model to thelikelihood score to generate the flow score.
 20. The network trafficmanagement system of claim 16, wherein the processors are furtherconfigured to execute the stored programmed instructions to select themodel from a plurality of stored models based on a current time or aplatform corresponding to a flow associated with the network traffic.